FAQ

Greeting fellow Monyets,

This is an IMPORTANT community notice from a global incident. NOT a drill; NOT a joke. Take it seriously.

The whole Internet is on high alert at the moment.

I try to explain as layman as possible but this incident is indeed technically complex but very simple if you understand it. If anyone can further simplify for non-tech person, please go ahead and help the others.

This is not the time to taruk each other. Let's get everyone safe first.

Side-note: mod, please help.

PROBLEM

As of 2026-10-20, there are 8 compromised SSL security certificates globally due to flawed procedure that used trivially small private keys. This affects ALL devices (Windows, Linux, Embedded Linux, FreeBSD, Embedded FreeBSD, Android, iOS, macOS, etc).

UPDATE:

Impact range: anything connects to Internet like laptop, pc, phone, smart TV, smart this, smart that, etc.

Emudhra used flawed keys (one of them is as primitive as literal '4') for very trusted transactions a long time ago. This allow any "hacker" to easily impersonate them and becomes "Man in the Middle" for https and tls connection without even needing to "hack" or to use any heavy tool to "smack".

In layman term, imagine someone from banking think "4" (1 character) is a good "password" and now screwed up the whole global banking system. The only way out is to distrust those "passwords".

IMPACT

This means your green lockpad on browser (https and tls) and any other network related applications (especially curl) are now compromised if you continue to trust those 8 certificates. It is providing false sense of security.

UPDATE:

In layman term, the attacker already know "4" is the password, he just key in with it and enter the bank easily as employee, make an official bank-owned account under his control, tell you to transfer money to this account. You will comply because on your side, you see it is the official bank tells you to do it.

WHAT IS NOT

1. This is not about what cert you and your organization procured to use (e.g. Lst's Encrypt, DigiCert). It is about those old upstream trusted certificates were compromised and everyone needs to distrust all 8 of them.
2. This is not an AI or hacker attack. Just some flawed implementation from Emudhra which can lead to those attacks in the near future.
3. This is not some flaws in technology. It is a human problem.
4. These certificates served the Internet long time ago so it is inside a lot of trusted cert stores.
5. Distrust is not delete. You still keep them but explictly distrust them in order not to use them automically. This is where the technical knowledge is still required although the actionables below are quite simple but cumbersome.

YOUR MISSION

Your main and sole objective is to DISTRUST all Emudhra's 8 compromised certificates from any app, per computing device (including phone).

Urgency: as immediate as possible (STAT). The more you delay, the more danger you are exposed.

For business organizations, please inform your IT department's blue team to distrust those compromised certificates and work with the suppliers (e.g. Microsoft, Apple, Google, etc). If your TLS certificate's Chain of Trust is under Emudhra, your IT deparment need to have an emergency meeting to strategize swapping the compromised cert to a new chain.

For consumers, MAKE SURE YOU UPDATE all the apps and the OS (e.g. Android Firefox is: 158.0.2, FreeBSD OS is: FreeBSD-caroot: 15.1p6) matching their respective Emudhra CA incident announcements. For Microsoft Windows PC/laptop, wait for Microsoft instructions (sorry, can't help. I'm one of those UNIX dinasour guy since 2 decades ago).

UPDATE

For banking apps, you need to contact the bank customer service and raise concern using "Emudhra, TLS, Security, Certificate, Compromised" as keywords and this link as reference: https://emudhra.we-have-a-problem.com/

If the bank believes they are compromised, they will update their apps and issue an announcement.

The first link I shared below contains a section where you can check any given device app on a device is affected. The list of Results MUST show Did not connect for ALL in order to pass. You DO NOT WANT TO CONNECT to them. Refer to my comment for screenshots.

You can also go through the following resources to validate the integrity of this post.

Side-notes

if you have IT background, help out the non-IT people especially like your mom and dad, elders, and folks around.

Good luck. Fair winds.

AVAILABLE RESOURCES

• https://emudhra.we-have-a-problem.com/
• https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/
• https://blog.cloudflare.com/emudhra-certificate-compromise
• https://www.freebsd.org/security/advisories/FreeBSD-SA-26:73.caroot.asc
• https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
• https://www.reddit.com/r/cybersecurity/comments/1xb0onb/emudhra_intermediate_ca_compromise/
• https://www.reddit.com/r/sysadmin/comments/1xb1lb1/emudhra_intermediate_ca_compromise/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
• https://www.reddit.com/r/india/comments/1xbi4ka/what_is_emudhra_and_why_internet_is_having_a/
• https://blog.netbsd.org/tnf/entry/emudhra_tls_ssl_ca_compromise
• https://emudhra.com/en/post/certificate-security-incident

Hi, Im here asking for help to rescue a cat that my partner picked up from the middle of the road in Selayang. It's currently suffering from broken jaw, mites and fleas etc. We took it to the vet and the vet said that we might have to pay around RM1000, might be more or less. The amount is a bit too much for us, l hope you all can help us out with this🙏 We appreciate any amount of donation.

The cat is currently receiving treatment at Kepong Pets Animal Clinic (No.6-G, PUSAT NIAGA, Jalan Prima 5, Metro Prima, 52100 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur). If you would like to verify the situation before donating, you are welcome to contact the clinic directly to double-check.

Thank you for your kindness and support. ❤️🐾

Source

Not again... Tunku Putra-HELP International school.
Edit: unverified reports state a penknife was used; (they edited it to remove the source's name lol) other hearsay claim coverup
Edit 2: found his livestream... axe at 2:04
Edit 3: archive of the full video; confirms that a hatchet was used; not a penknife

Source: X / Twitter Link

Avid user of grab food since past 4 years and it’s getting worse day by day. I ordered meal from grab and the merchant cancelled my half order.

I paid RM 20 for the whole order and grab upped my delivery fees and charged me RM 15 for half food. Not only that my delivery was saver and I waited for food for 1 hour plus for which I am charged 4 myr?

Tried to cancel the order. Can’t cancel. Tried to reach out to customer service can’t reach. Had to go through emergency option to reach them.

Reached out to their customer service and they are slow not replying for multiple minutes and not even offering partial refund. What am I supposed to do with RM5 compensation voucher?

Is this happening with just me or more people? And I have grab membership too???

I have done every steps as best as I could and I still stuck here.

It just happened randomly today out of nowhere, not sure what I did that led to this.

I don't even get an option to proceed anyway or something like that.

this is along persiaran subang permai

MBSJ proudly announced the new footpath that goes around the abandoned plot in front of easyhome mall (https://www.thestar.com.my/metro/metro-news/2026/10/05/upgrades-in-usj1-nearing-completion) but cannot add safe crossings or footpath in dense areas, same story in commercial area where you have to walk next to parked car

is there any portal where i can at least lodge a complaint

For the general public, the Tl:DR/ELI5 is that:

1. NO ACTION REQUIRED for this case. Just For Your Info.
2. Manage your expectation that you will see A LOT of website and apps intentionally taken down offline for self-protection until their developers fix the server (About 70% of sites worldwide[1]).
   1. If I'm not mistaken, most SMEs or even goverment agencies in Malaysia are using WordPress as the foundation software.
   2. For business owners, if your agency took your sites down because of these threats: please cooperate and not threaten.
3. Some of you might get bored, touch grass, river trekking, or try congkak for once.

WHAT IS IT ABOUT

PHP versions 5.4–8.5 contains vulnerability to allow remote code executions (RCE). That means attackers can do whatever they want to any PHP server.

The immediate threat I can sense is turning a legitimate server into a hidden remote control server (known as botnet) or some crypto-mining machine.

Another scenario is fishing those LLM A.I. API token for own use so watch your LLM A.I token billing if you wanna avoid sudden bankcruptcy.

Another scenario (if you are that lucky to be unlucky), a swarm of A.I. agents turn a server into their community message boards[8].

IMPACT

All PHP-based products, including WordPress, Drupal, and Joomla.

According to the document, it is about 70% of the websites worldwide.

CURRENTLY SEEN WORKAROUND

I am already seeing a lot of official websites intentionally bring their server offline just to be on an absolute safe side.

WHAT TO EXPECT

It's upto the PHP website/app developers to patch the server.

IS MCMC|NACSA INVOLVED

I do not know. I expect they are aware of it and will take over the general public cyber-safety coordination on TV news soon.

EPILOGUE

That is all. Fair winds to the PHP folks.

Site-Note

I'm SO DONE with the tech industry and wanna career change to agriculture or hotelier soon.

REFERENCES

1. https://www.php2shell.com/
2. https://nvd.nist.gov/vuln/detail/cve-2026-109619
3. https://db.gcve.eu/vuln/CVE-2026-109618
4. https://nvd.nist.gov/vuln/detail/cve-2026-109618
5. https://db.gcve.eu/vuln/CVE-2026-109619
6. https://en.wikipedia.org/wiki/PHP2Shell
7. https://www.reddit.com/r/freebsd/comments/1xbhc7y/php2shell_two_unpatched_critical_php_rce_flaws/
8. https://www.youtube.com/watch?v=ujkD4SxPKOI
9. https://en.wikipedia.org/wiki/PHP2Shell

Hi everyone!

I’m trying to ship some pandan powder (dry, commercially packaged food powder) from Malaysia to the UK. I contacted EasyParcel about shipping via UPS, but they told me it’s not allowed because it’s classified as a food item. I’m a bit confused since it’s just dry powder, not fresh food or liquid.
Has anyone successfully shipped pandan powder or similar dry food products overseas, especially to the UK? Are there any couriers that accept this type of item without issues? Does anyone know which couriers accept this type of product? Maybe DHL, FedEx, EMS, Pos Malaysia, Flickpost or any other shipping service?

I’d really appreciate any recommendations or experiences!

Thanks in advance